Firefox 48 ships, bringing Rust mainstream and multiprocess for some

Alexey Zhukov

09:17, August 3, 2016

Firefox 48 shipped today with two long-awaited new features designed to improve the stability and security of the browser.

After seven years of development, version 48 is at last enabling a multiprocess feature comparable to what Internet Explorer and Google Chrome have offered as stable features since 2009. By running their rendering engines in a separate process from the browser shell, IE and Chrome are more stable (a webpage crash does not take down the entire browser) and more secure (those separate processes can run with limited user privileges). In order to bring the same multiprocess capability to Firefox, Mozilla started the Electrolysis project in 2009. But the organization has taken substantially longer than Microsoft, Google, and Apple to ship this feature.

Mozilla's delay was partly driven by changing priorities within the organization—Electrolysis development was suspended in 2011 before being resumed in 2013—and partly because Firefox's historic extension architecture made this kind of separation much harder to achieve. Traditional Firefox extensions can invasively meddle with parts of the browser, and many assumed equal access both to the rendering engine and to the browser's shell. Firefox's developers had to both create a new extension system (they've ended up using HTML and JavaScript-based extensions closely related to those pioneered by Chrome and also adopted by Edge) and create shim layers to offer developers a temporary way to continue to support their old extensions.

Even after all this time, Firefox's multiprocess system is not a match for its peers. The rollout of Electrolysis is being handled conservatively in spite of a successful beta. For the next few days, only a fraction of a percent of Firefox 48 users will have Electrolysis turned on by default. If this mini-rollout goes well, the multiprocess feature will be rolled out to about half of all Firefox 48 users and will be extended to handle extensions known to be compatible in Firefox 50. Electrolysis will then be rolled out to Firefox 51 users with touchscreen devices, right-to-left languages, and disabled accessibility software, making it available to most Firefox users.

Firefox's multiprocess feature will still fall short of what Edge, Chrome, and Safari do, as it will use a single process for every tab. Those other browsers tend to use one process for one tab (or perhaps for a small handful of tabs). This means that not only does a crash in the renderer protect the browser shell; it also avoids any contagion between tabs wherein one tab crashing causes another one to die. It also prevents any data leaks between tabs. Support for one process per tab is currently due to be rolled out in the first half of 2017. After that is done, the extensions will be moved to separate processes, too.

As much as Firefox lags in this area, it's cutting edge in another. Mozilla's Rust language is designed to give the same level of performance and control as C++ but without C++'s susceptibility to security flaws. The company has developed Rust code to replace the C++ code that currently handles complex media formats. This replacement code is now shipping in the stable version of Firefox 48.